- Move spawn import in git-checkout.ts to lazy require() to prevent
node:child_process from being included in browser bundles
- Add ./git-checkout subpath export in package.json
- Update project-workspace.ts to use direct subpath import
- Update test mock to match new import path
Fixes: Vite crash from child_process externalization error,
API crashloop from missing readGitCheckout export
Extend the existing NewSpaceDialog project flow so an optional host
folder becomes the space workspace root. When .git metadata is present,
remote URL, default branch, and head commit are stored on the space.
Team Computer file APIs expose the linked folder under project/ without
a second VCS stack. Desktop adds a native folder picker; web falls back
to an absolute path field.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
The executor calls finalizeRun with toolCallBudgetCount and
toolCallBudgetExceeded in the updateMany data clause, but these
fields were missing from the Prisma schema, causing an Invalid
updateMany invocation error that blocked all runs from completing.
Also updated CLAUDE-RESUME-NOW with full infrastructure status.
claimSteering matched steering rows by runId even after they were
claimed, and still returned them when updateMany updated zero rows.
That could inject duplicate user context into an active run.
Filter findMany to claimedAt: null and return nothing when the claim
update does not land.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
answerRunInput already blocked cross-member answers for credential
secret asks and always-allow approvals, but one-time allow/deny and
generic OTP secret asks had no run.userId check. Align the DB gate so
shared-space prompt answers cannot be hijacked at the persistence layer.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Team mode shares one disk per Space. RPC and executor paths under
bots/<otherBotId>/ were reachable with any member-owned entry bot,
leaking another member's workspace files while same-user cross-bot
access stays intentional.
Add path guards, filter bot listings, regression tests.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
When a delegated bot finishes but its wake message was deleted (e.g.
thread clear), returnBotMessageOutcome used to mark botOutcomeReturnedAt
and drop the coordinator reply silently. Retry instead, and block
clearThread while completed bot_message runs still owe a return.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
